(L1) Enable sensitivity labels for Fabric content

Contributed by jeremy finneyAll contributors →

Part of CIS · Microsoft Fabric · Information protection · All checks

Run this check

Invoke-Maester -TestId CIS.M365.9.1.6

Overview

Users can apply Microsoft Purview sensitivity labels to supported Fabric content.

This setting enables label application in Fabric. It does not confirm that labels are published to users or that all sharing and export paths enforce label protection; the setting applies to supported exports.

Remediation action

1. Confirm that sensitivity labels are configured and published to the intended users, and that the required licensing prerequisites are met.
2. Sign in to the Microsoft Fabric admin portal with a Fabric administrator account.
3. Select Tenant settings.
4. Scroll to Information protection.
5. Set Allow users to apply sensitivity labels for content to Enabled, or choose Enabled with Specific security groups selected and defined. Select Apply.

Related links

• Information protection tenant settings
• Sensitivity labels in Power BI
• CIS Microsoft 365 Foundations Benchmark v7.0.0

Details

Every attribute of this check

Field	Value
Test ID	CIS.M365.9.1.6
Severity	Medium
Suite	CIS
Product	Microsoft Fabric
Feature	Information protection
Area	Data protection
Resource type	Tenant
User impact	Low
Implementation cost	Medium
MITRE ATT&CK	None
Supports benchmark	CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 9.1.6
Benchmark level	L1
Benchmark profiles	E3 Level 1
Supports controls	cis-m365:9.1.6, nist-800-53-r5:AC-16
PowerShell test	Test-MtCisFabricSensitivityLabelsEnabled
Services	Azure

Source

• Test: tests/cis/Test.CIS.M365.9.1.6.ps1
• Documentation: tests/cis/Test.CIS.M365.9.1.6.md